Adobe Patches Acrobat Chrome Extension Flaw That Exposed WhatsApp Web Chats to Any Website

Adobe has patched a series of vulnerabilities in its Acrobat Chrome extension that previously allowed any website to access conversations in WhatsApp Web without proper authentication, according to a report from cybersecurity firm Guardio shared with BleepingComputer.

The vulnerabilities, collectively identified as CVE-2026-48294 and called HermeticReader, affect Adobe Acrobat Chrome extension versions 26.5.2.1 and earlier.

Adobe addressed the issue in version 26.5.2.3, which is rolled out automatically, but Guardio advises users to verify that they are running the updated release.

Exploitation of the flaw required only that a user with the extension installed visit a malicious webpage. Guardio reports no signs that the vulnerability has been actively exploited.

How the Attack Worked and What Data Was Exposed

The Adobe Acrobat extension uses an integration engine called Hermes to manage interactions with WhatsApp Web. Hermes remains inactive until a feature flag is enabled in the extension's internal storage.

Once activated, it can open a PDF shared via WhatsApp and send commands to a tab running the messaging service, manipulating WhatsApp’s Document Object Model.

According to Guardio, HermeticReader exploits three vulnerabilities that together enable an unauthenticated, single-visit, zero-click write into the extension's own storage from any web page.

The extension includes an internal HTML resource that any page can embed as an iframe. This resource receives commands through a URL parameter, which is then passed to the extension's service worker without verifying whether the command originated from a legitimate Adobe content script.

By providing a predictable Tab ID, an attacker could disguise commands as internal extension messages, activate the WhatsApp integration, and redirect the extension's privileged DOM operations to a WhatsApp Web tab.

Guardio demonstrated data theft by injecting a form into WhatsApp Web, moving the page's live body into an op…